CVE-2024-44682

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

ShopXO 6.2 is vulnerable to Cross Site Scripting (XSS) in the backend that allows attackers to execute code by changing POST parameters.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 30, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-446836.1Seacms v13 is vulnerable to Cross Site Scripting (XSS) via admin-video.php.CVE-2024-446846.1TpMeCMS 1.3.3.2 is vulnerable to Cross Site Scripting (XSS) in /h.php/page?ref=addtabs via the "Title," "Images," and "Content" fields.CVE-2024-446855.0Titan SFTP and Titan MFT Server 2.0.25.2426 and earlier have a vulnerability a vulnerability where sensitive information, including passwordCVE-2024-44697.5The WP STAGING WordPress Backup Plugin WordPress plugin before 3.5.0 does not prevent users with the administrator role from pinging conducCVE-2024-44705.4The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide_infCVE-2024-44718.0The 140+ Widgets | Best Addons For Elementor – FREE for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.CVE-2024-447166.1A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2024-447176.1A cross-site scripting (XSS) vulnerability in DedeBIZ v6.3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2024-44725.5An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and sCVE-2024-447207.5SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component admin_safe.php.CVE-2024-447219.8SeaCMS v13.1 was discovered to a Server-Side Request Forgery (SSRF) via the url parameter at /admin_reslib.php.CVE-2024-447229.8SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd.
CVE-2024-44682: Medium severity, CVSS 6.1 | Vulnix